[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"category-security":3,"category-posts-security-1":8},{"id":4,"name":5,"slug":6,"count":7},"b3a78a8c-3551-4d2a-b19d-4576380e39fb","Security","security",5,{"posts":9,"totalPages":117},[10,33,54,75,96],{"id":11,"slug":12,"title":13,"content":15,"excerpt":17,"date":19,"link":20,"categories":21,"_embedded":22},"041bfa2f-130a-46a7-98b5-9ef49dd359a6","microsoft-discovers-privilege-escalation-vulnerabilities-in-linux",{"rendered":14},"Microsoft Discovers Privilege Escalation Vulnerabilities in Linux",{"rendered":16},"\u003Cp>Security researchers at Microsoft have discovered several vulnerabilities in Linux System. The vulnerabilities collectively referred to as Nimbuspwn, could allow an attacker to elevate privileges to root on many Linux desktop endpoints. These vulnerabilities allow to deploy payloads, like a root backdoor and perform other malicious actions via arbitrary root code execution. \u003C\u002Fp>\u003Cp>The vulnerabilities are referred to as \u003Ca href=\"https:\u002F\u002Fcve.mitre.org\u002Fcgi-bin\u002Fcvename.cgi?name=CVE-2022-29799\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CVE-2022-29799\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fcve.mitre.org\u002Fcgi-bin\u002Fcvename.cgi?name=CVE-2022-29800\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CVE-2022-29800\u003C\u002Fa>. The vulnerabilities are rooted in a systemd component called networkd-dispatcher, a daemon program for the network manager system service that’s designed to dispatch network status changes. \u003C\u002Fp>\u003Cp>The goal of networkd-dispatcher is to dispatch network status changes and optionally perform different scripts based on the new status. It runs on boot as a root. There is a certain time between the scripts being discovered and them being run. An attacker can abuse this vulnerability to replace scripts that networkd-dispatcher believes to be owned by root with ones that are not.\u003C\u002Fp>\u003Cp>To ensure Linux executes the attacker-supplied malicious script rather than the legitimate one, the attackers can plant multiple scripts until one finally succeeds. Microsoft researchers shared a proof-of-concept where they highlighted that in three attempts, they were able to successfully plant their files.\u003C\u002Fp>\u003Cimg src=\"https:\u002F\u002Fimage.trendibit.com\u002Fuploads\u002F63c78e4c-f818-420d-8a07-874fd476ad1b.png\" alt=\"Microsoft Discovers Privilege Escalation Vulnerabilities in Linux\" title=\"\" \u002F>\u003Cp>Fixes for these vulnerabilities have been successfully deployed by the maintainer of the networkd-dispatcher, Clayton Craft. Users will be able to find the new version in a systemd update on their Linux machines. Otherwise, they can deploy the patches by manually installing the latest network-dispatcher build.\u003C\u002Fp>",{"rendered":18},"Security researchers at Microsoft have discovered several vulnerabilities in Linux System. The vulnerabilities collectively referred to as Nimbuspwn, could allow an attacker to elevate privileges to root on many Linux desktop endpoints. These vulnerabilities allow to deploy payloads, like a root backdoor and perform other malicious actions via arbitrary root code execution. The vulnerabilities are referred [...]","2022-04-27T18:12:39Z","\u002Fmicrosoft-discovers-privilege-escalation-vulnerabilities-in-linux",[4],{"wp:featuredmedia":23,"wp:term":26,"author":30},[24],{"source_url":25,"alt_text":14},"https:\u002F\u002Fimage.trendibit.com\u002Fuploads\u002Fcf126d24-0fd0-4451-a515-c23e248955cb.jpg",[27],[28],{"name":5,"id":4,"taxonomy":29,"slug":6},"category",[31],{"name":32},"TrendiBit",{"id":34,"slug":35,"title":36,"content":38,"excerpt":40,"date":42,"link":43,"categories":44,"_embedded":45},"764bcc04-2c21-4a67-8981-dbdc419b30ac","7-zip-vulnerability-allows-privilege-escalation-workaround",{"rendered":37},"7-Zip Vulnerability Allows Privilege Escalation, Here’s a Workaround",{"rendered":39},"\u003Cp>A zero-day vulnerability has been found on the popular open-source achieving program 7-Zip. This vulnerability has been characterized as allowing privilege escalation and command execution. That means that someone with limited access to your system would be able to gain admin access. \u003C\u002Fp>\u003Cp>The vulnerability has been discovered by researcher Kağan Çapar and it is designated as \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fkagancapar\u002FCVE-2022-29072#readme\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CVE-2022-29072\u003C\u002Fa>.  CVE-2022029072 surmises “Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.” \u003C\u002Fp>\u003Cp>This vulnerability affects Windows users running version 21.07 — the latest version as of now. The vulnerability works by dropping a specially crafted file with a .7z extension (mimicking the 7-zip file extension) onto the 7-zip help window. It causes a heap overflow in 7zFM.exe and results in privilege elevation. \u003C\u002Fp>\u003Ch2>\u003Cstrong>Workaround\u003C\u002Fstrong>\u003C\u002Fh2>\u003Cp>As of now current version of 7-zip for Windows, v21.07 isn’t patched for the vulnerability. But you can do the following to mitigate the issue.\u003C\u002Fp>\u003Col start=\"1\">\u003Cli>\u003Cp>Open the 7-Zip installation directory.\u003Cstrong> C:\\Program Files\\7-Zip\u003C\u002Fstrong> for the 64-bit version of the application or \u003Cstrong>C:\\Program Files (x86)\\7-Zip\u003C\u002Fstrong> for the 32-bit version of the application. \u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>Locate the file \u003Cstrong>7-Zip.chm\u003C\u002Fstrong> file and delete it by pressing \u003Cstrong>Shift+delete\u003C\u002Fstrong> and then press yes. If you get a \u003Cstrong>File Access Denied\u003C\u002Fstrong> prompt then simply select continue.\u003C\u002Fp>\u003C\u002Fli>\u003C\u002Fol>",{"rendered":41},"A zero-day vulnerability has been found on the popular open-source achieving program 7-Zip. This vulnerability has been characterized as allowing privilege escalation and command execution. That means that someone with limited access to your system would be able to gain admin access. The vulnerability has been discovered by researcher Kağan Çapar and it is designated [...]","2022-04-20T06:15:32Z","\u002F7-zip-vulnerability-allows-privilege-escalation-workaround",[4],{"wp:featuredmedia":46,"wp:term":49,"author":52},[47],{"source_url":48,"alt_text":37},"https:\u002F\u002Fimage.trendibit.com\u002Fuploads\u002F2dc4484f-1c4e-43f3-a3b5-031360b895e6.jpg",[50],[51],{"name":5,"id":4,"taxonomy":29,"slug":6},[53],{"name":32},{"id":55,"slug":56,"title":57,"content":59,"excerpt":61,"date":63,"link":64,"categories":65,"_embedded":66},"f493dc96-c92f-4980-a84c-30c57b8d6bfb","russian-hackers-are-trying-to-steal-coronavirus-vaccine-research",{"rendered":58},"Russian Hackers Are Trying to Steal Coronavirus Vaccine Research",{"rendered":60},"\u003Cp>Due to coronavirus pandemic, most of the people are locked in their houses. Thousands of people are getting infected every day. So every country in the world is their best to invent a vaccine of COVID-19. Now the US, Canada, and UK government officials are saying that ‘state-backed hackers’ are trying to steal this vaccine research. \u003C\u002Fp>\u003Cp>The UK’s National Cyber Security Centre (NCSC) said the hackers “almost certainly” operated as “part of Russian intelligence services”. Hackers are trying to get information related to the development of vaccines for the novel coronavirus. \u003C\u002Fp>\u003Cp>According to the security agency, all signs point to the hacking group APT29 also known as Cozy Bear. Cozy Bear is also accused of many cyber attacks in the past and its believed that they are close to Russian intelligence agencies. \u003C\u002Fp>\u003Cp>The UK, US, and Canadian agencies said the hackers had exploited software flaws to get access to vulnerable computer systems and had used custom malware called WellMess and WellMail to upload and download files from infected machines. \u003C\u002Fp>\u003Cp>“The National Security Agency, along with our partners, remains steadfast in its commitment to protecting national security by collectively issuing this critical cyber-security advisory as foreign actors continue to take advantage of the ongoing Covid-19 pandemic,” said NSA cyber-security director Anne Neuberger.\u003C\u002Fp>",{"rendered":62},"Due to coronavirus pandemic, most of the people are locked in their houses. Thousands of people are getting infected every day. So every country in the world is their best to invent a vaccine of COVID-19. Now the US, Canada, and UK government officials are saying that ‘state-backed hackers’ are trying to steal this vaccine [...]","2020-07-17T15:25:44Z","\u002Frussian-hackers-are-trying-to-steal-coronavirus-vaccine-research",[4],{"wp:featuredmedia":67,"wp:term":70,"author":73},[68],{"source_url":69,"alt_text":58},"https:\u002F\u002Fimage.trendibit.com\u002Fuploads\u002F425946ba-e8eb-4815-9fa6-0e6a433ef7cd.jpg",[71],[72],{"name":5,"id":4,"taxonomy":29,"slug":6},[74],{"name":32},{"id":76,"slug":77,"title":78,"content":80,"excerpt":82,"date":84,"link":85,"categories":86,"_embedded":87},"1ae853b8-5d04-4c15-999f-280bfb53400f","fake-tiktok-pro-links-on-whatsapp-targeting-users-with-malware",{"rendered":79},"Fake ‘TikTok Pro’ Links on WhatsApp Targeting Users With Malware",{"rendered":81},"\u003Cp>A few days back Indian govt\u003Ca href=\"https:\u002F\u002Fcms.trendibit.com\u002Findian-government-officially-banned-59-chinese-apps-including-tiktok\u002F\" target=\"_blank\" rel=\"noopener noreferrer nofollow\"> ban TikTok \u003C\u002Fa>along with 58 other Chinese apps. Days after the ban Google Playstore and Apple App Store remove TikTok too. Leaving no way for Indians to download the app from the official app store of both Android and iOS. According to the Maharashtra Cyber cell, many internet user are getting fake TikTok Pro app links that contain malware.\u003C\u002Fp>\u003Cp>According to the cybersecurity authority, the links that are being sent via instant messaging applications like WhatsApp or even in text messages. These links contain malware that is targeted to steal data from the user.\u003C\u002Fp>\u003Cp>So if you have got these types of messages please don’t click them. In general, you should always download apps from official sources and never install any app files that are distributed through messaging apps.\u003C\u002Fp>",{"rendered":83},"A few days back Indian govt ban TikTok along with 58 other Chinese apps. Days after the ban Google Playstore and Apple App Store remove TikTok too. Leaving no way for Indians to download the app from the official app store of both Android and iOS. According to the Maharashtra Cyber cell, many internet user [...]","2020-07-09T22:28:05Z","\u002Ffake-tiktok-pro-links-on-whatsapp-targeting-users-with-malware",[4],{"wp:featuredmedia":88,"wp:term":91,"author":94},[89],{"source_url":90,"alt_text":79},"https:\u002F\u002Fimage.trendibit.com\u002Fuploads\u002Fe3c5279d-efd5-4810-bd6b-8852e5e4ccee.jpg",[92],[93],{"name":5,"id":4,"taxonomy":29,"slug":6},[95],{"name":32},{"id":97,"slug":98,"title":99,"content":101,"excerpt":103,"date":105,"link":106,"categories":107,"_embedded":108},"de8802de-7933-4e3e-9a59-ea5fc5451a10","dragonblood-vulnerability-wi-fi-wpa3",{"rendered":100},"Dragonblood: A New Vulnerabilities Affecting New WPA3 Stanard",{"rendered":102},"\u003Cp>Just a year ago WiFi Alliance announced new WPA3 Wi-Fi security standard as a replacement of the age-old WPA2 standard. The main goal of WPA3 was to make it nearly impossible to crack a network password. But this week, the same researchers behind the \u003Ca href=\"https:\u002F\u002Fwww.krackattacks.com\u002F\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">KRACK\u003C\u002Fa> disclosure in 2017 released five new WPA3 vulnerabilities collectively named \u003Ca href=\"https:\u002F\u002Fwpa3.mathyvanhoef.com\u002F\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Dragonblood\u003C\u002Fa>.\u003Cbr \u002F>\u003C\u002Fp>\u003Cp>WPA3 offers a host of features that make it more secure than its predecessor, such as Opportunistic Wireless Encryption, and completely changing how devices authenticate the access point. But no system is perfect and it’s also true for WPA3 standard. Researchers Mathy Vanhoef and Eyal Ronen have revealed five exploits that they are collectively referring to as “Dragonblood.”\u003Cbr \u002F>\u003C\u002Fp>\u003Ch3>\u003Cstrong>How WPA3 Is Affected:\u003C\u002Fstrong>\u003C\u002Fh3>\u003Cp>“The Dragonfly handshake, which forms the core of WPA3, is also used on certain Wi-Fi networks that require a username and password for access control. That is, Dragonfly is also used in the EAP-pwd protocol. Unfortunately, our attacks against WPA3 also work against EAP-pwd, meaning an adversary can even recover a user’s password when EAP-pwd is used. We also discovered serious bugs in most products that implement EAP-pwd. These allow an adversary to impersonate any user, and thereby access the Wi-Fi network, without knowing the user’s password. Although we believe that EAP-pwd is used fairly infrequently, this still poses serious risks for many users and illustrates the risks of incorrectly implementing Dragonfly,” researchers said in their paper. \u003C\u002Fp>\u003Cp>For more technical details see \u003Ca href=\"https:\u002F\u002Fpapers.mathyvanhoef.com\u002Fdragonblood.pdf\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">here.\u003C\u002Fa>\u003C\u002Fp>\u003Ch3>\u003Cstrong>What You Should Do?\u003C\u002Fstrong>\u003C\u002Fh3>\u003Cp>Dragonblood allows an attacker in range of a password-protected Wi-Fi network to obtain the password and gain access to sensitive information such as user credentials, emails, and credit card numbers. Although these Dragonblood vulnerabilities impact a small number of devices that were released with WPA3 support, and manufacturers are currently making patches available. One of the biggest takeaways for businesses of all sizes is to understand that a long-term fix may not be technically feasible for devices with lightweight processing capabilities such as IoT and embedded systems. \u003Cbr \u002F>\u003C\u002Fp>\u003Cp>To do the dragonblood attack, attackers need to bring an ‘Evil-Twin’ Access Point or Rogue Access Point into a Wi-Fi environment. So always use a trusted Wi-Fi environment to stay safe.\u003Cbr \u002F>\u003C\u002Fp>\u003Cp>The researchers have also informed the Wi-Fi Alliance about these flaws, and they’ve worked closely with the organization to fix the issue. The patches for the same have been released, and they’ll be made available via the usual software updates on different devices. So, updating your devices and installing the latest patches is the only way to move forward.\u003Cbr \u002F>\u003C\u002Fp>",{"rendered":104},"Just a year ago WiFi Alliance announced new WPA3 Wi-Fi security standard as a replacement of the age-old WPA2 standard. The main goal of WPA3 was to make it nearly impossible to crack a network password. But this week, the same researchers behind the KRACK disclosure in 2017 released five new WPA3 vulnerabilities collectively named [...]","2019-04-12T14:24:07Z","\u002Fdragonblood-vulnerability-wi-fi-wpa3",[4],{"wp:featuredmedia":109,"wp:term":112,"author":115},[110],{"source_url":111,"alt_text":100},"https:\u002F\u002Fimage.trendibit.com\u002Fuploads\u002Fea5ee4a4-4647-4bfc-9d06-fcfa8a67dcd4.jpg",[113],[114],{"name":5,"id":4,"taxonomy":29,"slug":6},[116],{"name":32},1]